CVE Listesine Dön
CVE-2020-11022

jQuery has a potential XSS vulnerability

CVSS Skor

6.9

EPSS İhtimal

%99.2

Risk Skoru

6.8

Yayın

6 yıl önce

Overview (Genel Bakış)Public Exploits (1)Newsroom (Haberler)Vulnerability Timeline
Resmî yama doğrulandı

Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.

Envanterimdeki Etkisi

Yalnızca hesabınıza eklediğiniz kişisel ürünler değerlendirilir; kurumsal envanter burada görünmez.

Oturum kontrol ediliyor…

Zafiyet Açıklaması

DayBreach CVE AI Araştırması

CVE-2020-11022 için toplanan üretici, dağıtım, yama ve güvenlik kaynağı kayıtlarını karşılaştırıp kanıt bağlantılı bir açıklama hazırlayalım.

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

IMPACT — Etkilenen Ürünler ve Yazılımlar

Affected Products

The following products are affected by CVE-2020-11022 vulnerability. Even if our threat engine is aware of the exact versions of the products that are affected, the information is represented below.

IDVENDORPRODUCTACTION
1JQueryJQuery İncele
2JQueryJQuery İncele
3drupaldrupal İncele
4drupaldrupal İncele
5drupaldrupal İncele
6debiandebian linux İncele
7fedoraprojectfedora İncele
8fedoraprojectfedora İncele
9fedoraprojectfedora İncele
10oracleagile product lifecycle management for process İncele
11oracleapplication testing suite İncele
12oraclebanking digital experience İncele
13oraclebanking digital experience İncele
14oraclebanking digital experience İncele
15oraclebanking digital experience İncele
16oraclebanking digital experience İncele
17oraclebanking digital experience İncele
18oracleblockchain platform İncele
19oraclecommunications application session controller İncele
20oraclecommunications billing and revenue management İncele
21oraclecommunications billing and revenue management İncele
22oraclecommunications diameter signaling router idih\ İncele
23oraclecommunications eagle application processor İncele
24oraclecommunications services gatekeeper İncele
25oraclecommunications webrtc session controller İncele
26oracleenterprise manager ops center İncele
27oracleenterprise session border controller İncele
28oraclefinancial services analytical applications infrastructure İncele
29oraclefinancial services analytical applications reconciliation framework İncele
30oraclefinancial services analytical applications reconciliation framework İncele
31oraclefinancial services asset liability management İncele
32oraclefinancial services asset liability management İncele
33oraclefinancial services asset liability management İncele
34oraclefinancial services balance sheet planning İncele
35oraclefinancial services basel regulatory capital basic İncele
36oraclefinancial services basel regulatory capital basic İncele
37oraclefinancial services basel regulatory capital internal ratings based approach İncele
38oraclefinancial services basel regulatory capital internal ratings based approach İncele
39oraclefinancial services data foundation İncele
40oraclefinancial services data governance for us regulatory reporting İncele
41oraclefinancial services data integration hub İncele
42oraclefinancial services data integration hub İncele
43oraclefinancial services data integration hub İncele
44oraclefinancial services funds transfer pricing İncele
45oraclefinancial services funds transfer pricing İncele
46oraclefinancial services funds transfer pricing İncele
47oraclefinancial services hedge management and ifrs valuations İncele
48oraclefinancial services hedge management and ifrs valuations İncele
49oraclefinancial services institutional performance analytics İncele
50oraclefinancial services institutional performance analytics İncele
51oraclefinancial services institutional performance analytics İncele
52oraclefinancial services liquidity risk management İncele
53oraclefinancial services liquidity risk measurement and management İncele
54oraclefinancial services liquidity risk measurement and management İncele
55oraclefinancial services liquidity risk measurement and management İncele
56oraclefinancial services loan loss forecasting and provisioning İncele
57oraclefinancial services loan loss forecasting and provisioning İncele
58oraclefinancial services market risk measurement and management İncele
59oraclefinancial services market risk measurement and management İncele
60oraclefinancial services price creation and discovery İncele
61oraclefinancial services price creation and discovery İncele
62oraclefinancial services profitability management İncele
63oraclefinancial services profitability management İncele
64oraclefinancial services profitability management İncele
65oraclefinancial services regulatory reporting for european banking authority İncele
66oraclefinancial services regulatory reporting for us federal reserve İncele
67oraclehealthcare foundation İncele
68oraclehealthcare foundation İncele
69oraclehealthcare foundation İncele
70oraclehealthcare foundation İncele
71oraclehospitality materials control İncele
72oraclehospitality simphony İncele
73oraclehospitality simphony İncele
74oraclehospitality simphony İncele
75oracleinsurance accounting analyzer İncele
76oracleinsurance allocation manager for enterprise profitability İncele
77oracleinsurance allocation manager for enterprise profitability İncele
78oracleinsurance data foundation İncele
79oracleinsurance insbridge rating and underwriting İncele
80oracleinsurance insbridge rating and underwriting İncele
81oraclejdeveloper İncele
82oraclejdeveloper İncele
83oraclejdeveloper İncele
84oraclepeoplesoft enterprise peopletools İncele
85oraclepeoplesoft enterprise peopletools İncele
86oraclepeoplesoft enterprise peopletools İncele
87oraclepolicy automation İncele
88oraclepolicy automation connector for siebel İncele
89oraclepolicy automation for mobile devices İncele
90oracleretail back office İncele
91oracleretail back office İncele
92oracleretail customer management and segmentation foundation İncele
93oracleretail returns management İncele
94oracleretail returns management İncele
95oraclesiebel ui framework İncele
96oraclestoragetek acsls İncele
97oracleweblogic server İncele
98oracleweblogic server İncele
99oracleweblogic server İncele
100oracleweblogic server İncele
101oracleweblogic server İncele
102netappmax data İncele
103netapponcommand insight İncele
104netapponcommand system manager İncele
105netappsnap creator framework İncele
106netappsnapcenter İncele
107netapph300s firmware İncele
108netapph300s İncele
109netapph500s firmware İncele
110netapph500s İncele
111netapph700s firmware İncele
112netapph700s İncele
113netapph300e firmware İncele
114netapph300e İncele
115netapph500e firmware İncele
116netapph500e İncele
117netapph700e firmware İncele
118netapph700e İncele
119netapph410s firmware İncele
120netapph410s İncele
121netapph410c firmware İncele
122netapph410c İncele
123opensuseleap İncele
124opensuseleap İncele
125tenablelog correlation engine İncele
126oracleagile product supplier collaboration for process İncele
127oraclebanking digital experience İncele
128oraclefinancial services analytical applications infrastructure İncele
129oraclehospitality simphony İncele
130oracleinsurance data foundation İncele
Total Affected Vendor: 8|Products: 130

RED HAT CSAF/VEX — Ürün Etki Kontrolü

Red Hat bu CVE için henüz bir CSAF/VEX etki kaydı yayımlamamış. Bu durum “etkilenmiyor” anlamına gelmez.

SCORING — CVSS Çoklu Kaynak Skoru

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from various sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
6.9CVSS V31MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:NNVD
6.9CVSS V3_1MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:NCVE CNA
6.1CVSS V31MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NNVD
4.3CVSS V2—AV:N/AC:M/Au:N/C:N/I:P/A:NNVD

Yama ve İyileştirme Rehberi (Solution)

Solution & Remediation Advisory

Yama doğrulandı

7 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

nvd

NVD tarafından Patch olarak etiketlenmiş referans

Kaynağı aç
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Kaynağı aç
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Kaynağı aç
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Kaynağı aç
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Kaynağı aç
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Kaynağı aç
reference

Yama veya çözüm referansı

Kaynağı aç
Etkilenen ürün ve sürümü yukarıdaki kaynak kanıtlarıyla doğrulayın.
İnternete açık servislerde erişimi kısıtlayın ve ağ segmentasyonu uygulayın.
Kanıtta belirtilen resmî güncellemeyi yalnızca eşleşen ürün ve sürüme uygulayın.
Sunucu günlüklerini ve ağ uçlarını anormal çalıştırma belirtileri için izleyin.

Public exploit ve aktif sömürü durumu

Doğrulanmış exploit istihbaratı

CVE-2020-11022 için veritabanında 1 public PoC/exploit kaynağı bulunuyor. Doğrudan kaynak bağlantıları için Public Exploits sekmesini açın.

Zafiyet Dağılımı ve Saldırı Kalıpları (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2020-11022 is associated with the following CWEs:

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2020-11022 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Saldırı Vektörü ve Erişilebilirlik Karakteristiği

ErişimAğ üzerinden
YetkiGerekmiyor
KullanıcıGerekiyor

Resmi Kaynaklar ve Danışma Bültenleri

https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2vendor-advisoryhttps://github.com/maximebf/php-debugbar/issues/447vendor-advisoryhttps://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77vendor-advisoryhttps://github.com/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fcvendor-advisoryhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3Wvendor-advisoryhttps://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.htmlvendor-advisoryhttps://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.htmlvendor-advisoryhttps://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.htmlvendor-advisoryhttps://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.htmlvendor-advisoryhttps://security.gentoo.org/glsa/202007-03vendor-advisory

CVSS Vektör Radar Grafiği

6.9 / 10
Attack VectorNetworkComplexityHighPrivilegesNoneUser Interact.RequiredConfidentialityHighIntegrityLowAvailabilityNone

Vulnerability Scoring Details

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
Attack VectorNetwork (Ağ)
Attack ComplexityHigh (Yüksek)
Privileges RequiredNone (Gerekmiyor)
User Interaction—
Confidentiality (Gizlilik)High (Yüksek)
Integrity (Bütünlük)Low (Düşük)
Availability (Erişilebilirlik)None (Yok)

Yama doğrulandı

7 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

Üreticiyi takip et

J
JQuery logo
JQuery
D
drupal logo
drupal
D
debian logo
debian
F
fedoraproject logo
fedoraproject
O
oracle logo
oracle
N
netapp logo
netapp

Zafiyet Türü (CWE & CAPEC)

CWE-79

İlgili Benzer Açıklar

Bu açığı API ile alın

Etkilenen ürünler, sürüm aralıkları, istismar durumu ve yama bilgisi tek istekte; ücretsiz anahtarla.

Ücretsiz anahtar alBelgeler
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2020-11022"
CVE-2020-11022 · jQuery has a potential XSS vulnerability